With the modem being integrated into the SoC, it's not something that can be easily removed. Many IoT vendors and automakers have been adding modems and such that keep your device "always connected" and in a way that bypasses your home internet (where people can filter, log, block ads, etc).
Is the possibility of future surveillance a concern for people?
They currently get a pass on the “trust us, everything is end-to-end encrypted” without providing open access/verifiable toolchains. They are large and high profile enough that the public can trust that there are enough experts and nerds keeping an eye on them to hold them to their promises.
Adding a data exfiltration radio has some of the same verifiability, in that you could put an antenna next to the device and verify that it does/does not send signals. However it is only a matter of time before the radio cannot be fully disabled for some reason or another (oh we just turn on the radio to get guaranteed network time as part of our Trusted Cloud Experience that we secure you with!). Once that ship sails the devices will no longer be owned by the users and cannot be trusted.
Couldn't this same concern apply to Wi-Fi chips? I fail to see how cellular would change much here. If any company (Apple or anyone else) wanted to do something nefarious like this, they could already do it today.
Wifi is in the same boat as the 3.5mm headphone jack
Right, it's an excellent technology that Apple wants to abandon without any valid reason.
I easily see this being a thing at some point where we discuss WiFi like its the fax machine. There's absolutely no need for WiFi if you have cellular + internet, it does everything better with less cost and maintenance. Makes no sense to have two chips doing the exact same thing on space-premium hardware such as iPhone
Most people cannot do this. Also an increasing number of people don't have wifi at home but just use their phones.
In 2021, 15% had access only through mobile devices (no wifi): https://www.pewtrusts.org/en/research-and-analysis/fact-shee...
> More than 83% of people in the U.S. access the internet on their smartphones, tablets, or other mobile devices. And these devices are the only means of internet connection for 15% of Americans. In general, because mobile access and wireline connections offer different speeds and functionality, consumers tend to view the two types of service as complementary and subscribe to both if they have the means.
A govt report (based on older data) points out that 20% of households have no household connectivity, and while various reasons are given ("don't need it" "can't afford it") the unconnected households tend to be the poorest, suggesting cost is a barrier: https://www.ntia.gov/blog/2022/switched-why-are-one-five-us-...
One of the reasons for going mobile-first, though these households have less spending money.
Is this meaningfully true for anyone? Most people can’t view activity at all or block anything, but even people who have some of the skills aren’t going to be able to keep up with the flood of activity on a household network.
This is also a fool’s errand if you’re worried about the OS vendor. They have a ton of ways to bury the data (would you know if time.apple.com was getting your data one packet at a time?) and could subtly compromise other things (is this connection to an ad server snuggling out data in the TCP source port or cookies?). I think your last sentence is really the final word here: auditing can help, regulation can help, but I don’t think traffic monitoring is giving more than false confidence for this kind of advanced attack.
For the those who are concerned about mass surveillance, tracking, etc, the fact that those of us who can view activity or block things don't see suspicious traffic is almost as valuable as doing it yourself. Kinda the same "many eyes" theory that applies to malicious code in open source, even if you can't check it yourself you benefit from those who can existing.
For those who are concerned about being the specific target of a government or major data company, if you don't have all the skills you're probably best off living like it's 1995.
Of course they know which networks are yours and you control them and might monitor them.
Your neighbour doesn't care about your data, nor the Starbucks you drive past to get to work. They could make the system connect to one of those and send its Secret Data Exfiltration Package using them.
Samsung has already done this with their TVs. If you don't connect it to a wifi, iIt'll just find an open one and connect so it can load ads.
Nothing good can come from a device having internet access outside of your control.
Apple has been moving in that direction for years though. In my humble opinion, I don't own any of my Apple devices since I can't even choose which version of Apple's OS to install, let alone install any software of my choosing, or third-party OS. They are proprietary appliances whose very usage is subject to Apple's continued blessing. Not that they're that different than any of their few competitors in these regards.
Fun, fun, fun.
There's nothing technical stopping Apple from transmitting all kinds of stuff over that interface, to their or somebody else's OTT network:
Amazon's Sidewalk network (originally based on LoRa, but it now also seems to support Bluetooth LE) supposedly covers 90% of the US population [1]; there's also the blockchain-based similar Helium Network, and probably some more I'm not aware of.
In other words: In my view, the ship of not having to trust a device vendor (or at least not as much) if it's not connected to the Internet has sailed.
A pervasive network that can be accessed with a couple dollar IC with minimal power that’s hidden from user would be much harder to escape.
Power hungry? Not anymore – I believe NB-IoT is already within an order of magnitude of unlicensed IoT (i.e. LoRa, 802.15.4 etc).
Expensive? That's relative, but what makes you think that Amazon is giving away Sidewalk for any less? AWS is not exactly known for their low prices.
In general, NB-IOT is operated by the cellular companies and has associated reliability expectations. Additionally the cruft leftover from it being a cellular product really added to complexity and cost to implement.
Unlicensed spectrum has much lower reliability, and I would expect them to charge less accordingly.
Sidewalk over BLE is a huge issue though. No way to block devices calling home :(
Once they have the capacity to build great modems and add it to their vertical integration/SoC process, it's another no brainer thing to add that makes their laptops best in class.
However, if it gets picked up by other tech companies then yes, expect your device to be always connected, even if it's against your will.
I wouldn’t argue for less privacy but I’ve already trusted Apple with a device that is with me even more than my laptop.
I think the big difference here is that with a Car, you're primarily buying a device for driving yourself from one place to another, and everything else is extra. With a computer, you buy a device to compute, and with that is practically always some internet-connected requirement. Buying a Car without internet, or radio, or infotainment is fine (if you can find one) because the primary reason you want the thing is still intact. A computer without computing and without internet isn't very useful.
Yes! I keep my personal MBP unconnected from the internet most of the time using a physically separate computer acting as firewall, and allow only traffic from Firefox, Electrum and command line utilities to reach the Internet.
Integrated mobile internet in the laptop is convenient in a lot of cases, but for me a dealbreaker.
Great analysis. A+
For me, personally no.
Of all the things I think about, the possibility of future surveillance is not one of them.
If somebody wanted to know what you were doing on your MacBook, they would just attack your phone.
You might have to give up wifi and bluetooth if you cut that out, though.